Screenshots:

Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)

About Imperium:

Tired of "crypters" promising good runtime execution rates yet they fail to comply because of overused old injection methods (dynamic forking also called "RunPE") ? Tired of using shared stubs which get detected in ~6 to 24 hours at best ? If so, you're in the right place.
Imperium was initially a private crypter fully coded in C/ASM then it came to our knowledge that most crypters in this forum doesn't comply with their promises and their fancy threads design, so we decided to give a chance to members here to have a taste of a real crypter under reasonable prices for the community(we are aware that most persons here can't afford the C/ASM version). In this view, we decided to make a low budget version by using a .NET loader instead of the C one and switching some evasions techniques to overcome the gap between price and quality.

• Completely unique injection method(never used in the field) assuring runtime evasion.
  
• Completely unique stubs(you build your own stub in USG tab).
  
• Small stub size.
  
• Bypassing SSDT hooks(eg. Norton & only AVs based filters) on x86 based machines(no crypter did that til now).
  
• High execution rates.
  
• Refund in case the crypter get caught at runtime by mainstream AVs(Avast, AVG, Bitdefender, KAV, ESET, Norton, TrendMicro, MSE).
  
• Active support.
  

• 1 Month usage & Ability to build 2 stubs: $150
  
• 1 Month usage & Ability to build 5 stubs: $280
  
• 3 Month usage & Ability to build 10 stubs: $600
  

• BTC, ETH, BCH(BitcoinCash) & LTC.
  

• Jabber: [email protected]
  

(Feb 10, 2018 04:55 AM)whendarknesscomes Wrote:  Can you shoot me a pm with runtime scans?

(Feb 10, 2018 06:24 AM)bad_c0de Wrote:  Runtime scans ? those runtime online scanners aren't even accurate, you can add me on jabber to test with any AV.

(Feb 10, 2018 08:19 AM)mehtevas Wrote:  why are these online scanners not accurate ?

(Feb 10, 2018 09:26 AM)ʀᴏᴏᴛᴇᴅ Wrote:  Screenshot shows injecting into svchost. You say you use a .net loader. Which .net framework does the loader target? Does it work with EOF data or .net files? Ring-3 book evasion, is it manual mapping into current process or syscall extraction? What injection technique is this using? Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost? Do you provide any anti-emulation? You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?

Sorry if I come off as aggressive. Your crypter is new on this forum and lacks technical details. PM if you want testing/vouch.

(Feb 10, 2018 09:54 AM)bad_c0de Wrote:  -"Which .net framework does the loader target?"
It targets any version you want.

-"Does it work with EOF data or .net files?"
Works with .NET files, but we don't support EOF since no modern malware use that.

-"Ring-3 hook evasion, is it manual mapping into current process or syscall extraction?"
Usermode hooks are not really needed to be bypassed im my case, but i'm doing it anyway(i map a new ntdll from the disk) and no it's not manual mapping.

-"What injection technique is this using? "
Technique is a mix between basic RunPE and Process Doppelganging(it's compatible with all windows versions in both arch).

-"Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost?"
i spawn wermgr by default because it's usually spawned when a crash happens and is signed by Microsoft but it works with svchost too.

-"Do you provide any anti-emulation?"
yeah we do.

-"You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?"
Answer is on the thread: to make a low budget version, there is a C/ASM version already in sales(not here).

-"Sorry if I come off as aggressive"
Not at all.

-"PM if you want testing/vouch."
We may provide vouch copies but not for now.

(Feb 10, 2018 11:27 AM)_GodLike Wrote:  use dyncheck for your runtime scan...

(Feb 10, 2018 12:11 PM)ʀᴏᴏᴛᴇᴅ Wrote:  Nicely layed out reply, and you gave all the answers I want to hear. You have my vouch.

Your injection method intrigues me. I have seen an interesting implementation of doppelgänger live in the wild, it uses the second half of the traditional PoC, creating the process from the section object, however it’s obtains the section object differently without using the transaction APIs. Maybe similar to your work, I have no idea.

One last thing, for most people, the definition of manual mapping is just that, imitating LoadLibaryA() reading a clean copy of ntdll.dll from the disk and mapping it into memory so the functions can be executed without any hooks, which sounds like what you’re doing.

Regardless, you have my vouch, good luck with sales.

(Feb 10, 2018 12:14 PM)mike10 Wrote:  hello

https://run4me.net/result/0857447d667e3e19ad8d61f8716bac7f2c32ce73c691eaeca41d871ca3d5797a

(Feb 10, 2018 12:14 PM)mike10 Wrote:  hello

https://run4me.net/result/0857447d667e3e19ad8d61f8716bac7f2c32ce73c691eaeca41d871ca3d5797a

(Feb 10, 2018 02:57 PM)_GodLike Wrote:  mfw

>too poor to afford $30 dyncheck
>uses a shitty excuse like "its not accurate!" to avoid providing runtime proof

GLWS THOUGH BUDDY!!

(Feb 11, 2018 03:58 AM)mehtevas Wrote:  what about CIS (https://www.comodo.com/home/internet-security/free-internet-security.php ) with hips enabled. & 360 Total security ( https://www.360totalsecurity.com/en/ )